@scrymore/scry-deployer 0.3.1 → 0.4.0

package/README.md

@@ -835,6 +835,31 @@ Then update the `if` condition in the notification steps:
 
 ---
 
+## 📊 Error Reporting
+
+When a deploy fails, this CLI reports the error to Scry so we can fix it. It runs on
+your machine, so it is worth being precise about what leaves it.
+
+**Sent:** the error and its stack trace, the CLI and Node versions, the platform, and
+the project id, deploy version, branch and whether analysis was enabled.
+
+**Not sent:** your API key, presigned upload URLs and their signatures, absolute file
+paths, your hostname or username, your component names, and your source code. Stack
+frames are reduced to file basenames, and anything resembling a credential is redacted
+before the report is sent — including the signed URLs that upload errors would
+otherwise quote in full.
+
+Nothing is reported on a successful run.
+
+**To opt out**, set either variable:
+
+```bash
+export SCRY_TELEMETRY=0     # Scry-specific
+export DO_NOT_TRACK=1       # respected across many CLI tools
+```
+
+Both are honoured everywhere, including CI.
+
 ## 🔧 Troubleshooting the Init Command
 
 ### Command fails with "Not a git repository"

package/bin/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-const Sentry = require('@sentry/node');
+const { initTelemetry, captureCliError, flushTelemetry } = require('../lib/telemetry.js');
 const yargs = require('yargs/yargs');
 const { hideBin } = require('yargs/helpers');
 const fs = require('fs');
@@ -166,21 +166,12 @@ async function handleError(error, argv) {
     const logger = createLogger(argv || {});
     logger.error(`\n❌ Error: ${error.message}`);
 
-    // Capture error in Sentry with additional context
-    Sentry.withScope((scope) => {
-        if (argv) {
-            scope.setTags({
-                project: argv.project,
-                version: argv.version,
-                command: argv._ ? argv._[0] : 'unknown',
-            });
-            scope.setExtra('argv', argv);
-        }
-        Sentry.captureException(error);
-    });
-    
+    // Report with an allowlisted subset of argv. Sending argv wholesale shipped
+    // the customer's --api-key to Sentry on every error.
+    captureCliError(error, argv);
+
     // Ensure the event is sent before the process exits
-    await Sentry.close(2000);
+    await flushTelemetry(2000);
 
     if (error instanceof ApiError) {
         if (error.statusCode === 401) {
@@ -198,12 +189,9 @@ async function handleError(error, argv) {
 }
 
 async function main() {
-    // Initialize Sentry
-    Sentry.init({
-        dsn: "https://c66ce229a1db2289f145eebd02436d9c@o4507889391828992.ingest.us.sentry.io/4510699330732032", // Fallback to hardcoded DSN for user reporting
-        tracesSampleRate: 1.0,
-        environment: process.env.NODE_ENV || 'production',
-    });
+    // Error reporting. Opt out with SCRY_TELEMETRY=0 or DO_NOT_TRACK=1.
+    // Configuration and scrubbing live in lib/telemetry.js.
+    initTelemetry();
 
     try {
         const args = await yargs(hideBin(process.argv))
@@ -421,9 +409,13 @@ async function main() {
                         alias: 'skipGhSetup'
                     })
                     .option('commit-api-key', {
-                        describe: 'Commit API key in config file (not recommended)',
+                        describe: 'Write the API key into the committed config file (not recommended)',
                         type: 'boolean',
-                        default: true,
+                        // False by default. The description has always said "not
+                        // recommended" while the default said otherwise, and the
+                        // default won: every `init` wrote a customer's key into a
+                        // file it then committed.
+                        default: false,
                         alias: 'commitApiKey'
                     })
                     .option('verbose', {

package/lib/init.js

@@ -47,19 +47,27 @@ async function runInit(argv) {
         // Step 3: Create config file
         const step3Start = Date.now();
         logger.info('3/8: Creating configuration file...');
-        createConfigFile(argv.project, argv.apiKey, argv.apiUrl, envInfo);
+        createConfigFile(argv.project, argv.apiKey, argv.apiUrl, envInfo, argv.commitApiKey);
         const step3Duration = Date.now() - step3Start;
         logger.success(`✅ Created .storybook-deployer.json [${step3Duration}ms]\n`);
 
-        // Step 4: Add to gitignore (optional - keep API key out of git if user prefers)
+        // Step 4: Report what the committed config does and does not contain.
+        //
+        // This step used to add `.storybook-deployer.json` to .gitignore, which was
+        // wrong in both directions. The config now holds no credential, so ignoring
+        // it would only stop a team sharing its project id — and the entry it wrote,
+        // `.storybook-deployer.json  # Contains API key`, never matched anything:
+        // in .gitignore a `#` is only a comment at the start of a line, so the
+        // pattern included the trailing text and git ignored no file.
         const step4Start = Date.now();
-        if (!argv.commitApiKey) {
-            logger.info('4/8: Updating .gitignore...');
-            updateGitignore();
-            const step4Duration = Date.now() - step4Start;
-            logger.success(`✅ Updated .gitignore (API key will use env vars in CI) [${step4Duration}ms]\n`);
+        if (argv.commitApiKey) {
+            logger.info('4/8: Checking credentials...');
+            logger.error(`⚠️  --commit-api-key: your API key will be written to .storybook-deployer.json and committed.
+   Git history keeps it after rotation, and CI does not need it — the key is
+   already stored as the SCRY_API_KEY repository secret. [${Date.now() - step4Start}ms]\n`);
         } else {
-            logger.info('4/8: Skipping .gitignore update (--commit-api-key flag set)\n');
+            logger.info('4/8: Checking credentials...');
+            logger.success(`✅ .storybook-deployer.json holds no credentials — safe to commit [${Date.now() - step4Start}ms]\n`);
         }
 
         // Step 5: Generate workflow files
@@ -94,7 +102,7 @@ async function runInit(argv) {
         // Step 7: Git commit
         const step7Start = Date.now();
         logger.info('7/8: Committing changes...');
-        const commitResult = gitCommit(argv.commitApiKey, logger);
+        const commitResult = gitCommit(logger);
         const step7Duration = Date.now() - step7Start;
         if (commitResult.success) {
             logger.success(`✅ Changes committed: ${commitResult.sha} [${step7Duration}ms]\n`);
@@ -236,7 +244,7 @@ function parseGitHubRemote(remote) {
 /**
  * Create the configuration file
  */
-function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
+function createConfigFile(projectId, apiKey, apiUrl, envInfo, commitApiKey) {
     const config = {
         apiUrl: apiUrl,
         project: projectId,
@@ -245,10 +253,19 @@ function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
         verbose: false
     };
 
-    // Only include apiKey in config if user wants it committed
-    // Otherwise it should be set via environment variable
-    // For now, we'll include it but note in .gitignore
-    config.apiKey = apiKey;
+    // The key is deliberately absent unless explicitly asked for.
+    //
+    // This file gets committed, and CI never reads the key from it — `init` sets
+    // SCRY_API_KEY as a GitHub *secret* and the generated workflow reads
+    // ${{ secrets.SCRY_API_KEY }}. So a copy here buys nothing and lands
+    // somewhere git history makes permanent: rotating the key afterwards does
+    // not remove it, and on a public repository it is simply disclosed.
+    //
+    // Local runs read SCRY_API_KEY from the environment, which lib/config.js
+    // already resolves.
+    if (commitApiKey) {
+        config.apiKey = apiKey;
+    }
 
     const configPath = '.storybook-deployer.json';
     fs.writeFileSync(
@@ -258,28 +275,6 @@ function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
     );
 }
 
-/**
- * Update .gitignore to exclude sensitive files (optional)
- */
-function updateGitignore() {
-    const gitignorePath = '.gitignore';
-    const entries = [
-        '# Scry Storybook Deployer',
-        '.storybook-deployer.json  # Contains API key'
-    ];
-
-    let gitignoreContent = '';
-    if (fs.existsSync(gitignorePath)) {
-        gitignoreContent = fs.readFileSync(gitignorePath, 'utf8');
-    }
-
-    // Check if already added
-    if (!gitignoreContent.includes('.storybook-deployer.json')) {
-        gitignoreContent += '\n' + entries.join('\n') + '\n';
-        fs.writeFileSync(gitignorePath, gitignoreContent, 'utf8');
-    }
-}
-
 /**
  * Generate workflow files
  */
@@ -367,7 +362,7 @@ Or install GitHub CLI and run:
 /**
  * Commit the changes to git
  */
-function gitCommit(commitApiKey, logger) {
+function gitCommit(logger) {
     try {
         // Check if there are changes to commit
         const status = execSync('git status --porcelain', { encoding: 'utf8' });
@@ -382,10 +377,6 @@ function gitCommit(commitApiKey, logger) {
             '.storybook-deployer.json'
         ];
 
-        if (!commitApiKey) {
-            filesToAdd.push('.gitignore');
-        }
-
         for (const file of filesToAdd) {
             if (fs.existsSync(file)) {
                 execSync(`git add "${file}"`, { stdio: 'pipe' });
@@ -449,7 +440,7 @@ function showSuccessMessage(projectId, envInfo, apiUrl, pushed) {
 Your Storybook deployment is configured and ready to go.
 
 📦 What was set up:
-   ✅ Configuration file (.storybook-deployer.json)
+   ✅ Configuration file (.storybook-deployer.json — no credentials, safe to commit)
    ✅ GitHub Actions workflows (.github/workflows/)
    ✅ Repository variables (SCRY_PROJECT_ID, SCRY_API_URL)
    ✅ Repository secret (SCRY_API_KEY)
@@ -461,6 +452,12 @@ ${!pushed ? `
    git push
 ` : ''}
 
+🔑 Running a deploy locally:
+   CI reads the key from the SCRY_API_KEY secret. On your own machine, export it
+   rather than writing it into the config file, which is committed:
+
+   export SCRY_API_KEY=<your key>
+
 🚀 Deployment:
    Your Storybook will deploy automatically on:
    • Every push to ${envInfo.currentBranch || 'main'} branch
@@ -477,4 +474,4 @@ Happy deploying! ✨
 `);
 }
 
-module.exports = { runInit };
+module.exports = { runInit, createConfigFile };

package/lib/telemetry.js

@@ -0,0 +1,140 @@
+const Sentry = require('@sentry/node');
+
+/**
+ * Error reporting for a CLI that runs on other people's machines.
+ *
+ * This is not a server. Everything it sends left a customer's laptop or CI
+ * runner, so the default has to be "send the minimum that makes a crash
+ * diagnosable", not "send the context and sort it out later".
+ *
+ * Three things were being sent that should not have been:
+ *
+ *   1. `scope.setExtra('argv', argv)` shipped the whole parsed argv — which
+ *      contains `--api-key` under both `apiKey` and `api-key`. Every customer
+ *      error carried their project credential to a third party.
+ *   2. Upload failures embed the presigned URL in the message, query string and
+ *      all: `...storybook.zip?X-Amz-Signature=645e57...`. That signature is a
+ *      time-limited write credential for the bucket.
+ *   3. Absolute paths (`/home/alice/work/app`) leak usernames and, often,
+ *      unreleased product names.
+ *
+ * None of that is needed to know that an upload failed with EAI_AGAIN.
+ */
+
+const DSN =
+  'https://c66ce229a1db2289f145eebd02436d9c@o4507889391828992.ingest.us.sentry.io/4510699330732032';
+
+/**
+ * argv fields safe to attach to an error.
+ *
+ * An allowlist, not a denylist: a new option should be invisible to telemetry
+ * until someone deliberately adds it here. The reverse — remembering to exclude
+ * each new secret — is the failure mode that put an API key in Sentry.
+ */
+const SAFE_ARGV_FIELDS = ['project', 'deployVersion', 'withAnalysis', 'verbose', 'branch'];
+
+/** Anything that looks like a credential, wherever it appears in a string. */
+const SECRET_PATTERNS = [
+  // Presigned URL query strings. Keep the path so the failing operation is
+  // still identifiable; drop the signature and everything with it.
+  [/(https?:\/\/[^\s?]+)\?[^\s]*/g, '$1?<redacted>'],
+  [/scry_proj_[A-Za-z0-9_\-]+/g, 'scry_proj_<redacted>'],
+  [/(X-Amz-Signature=)[^&\s]+/gi, '$1<redacted>'],
+  [/(Bearer\s+)[A-Za-z0-9._\-]+/gi, '$1<redacted>'],
+];
+
+function scrub(value) {
+  if (typeof value !== 'string') return value;
+  return SECRET_PATTERNS.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), value);
+}
+
+/**
+ * Whether the user has asked not to be tracked.
+ *
+ * DO_NOT_TRACK is honoured as well as our own flag — it is the cross-tool
+ * convention (consoledonottrack.com), and a developer who has set it globally
+ * should not have to discover a Scry-specific variable to be heard.
+ */
+function telemetryDisabled() {
+  const off = (v) => v === '1' || v === 'true' || v === 'yes';
+  return off(process.env.DO_NOT_TRACK) || process.env.SCRY_TELEMETRY === '0' ||
+    process.env.SCRY_TELEMETRY === 'false';
+}
+
+/** Only the fields on the allowlist, and scrubbed even then. */
+function sanitizeArgv(argv) {
+  if (!argv) return {};
+  const safe = {};
+  for (const field of SAFE_ARGV_FIELDS) {
+    if (argv[field] !== undefined) safe[field] = scrub(argv[field]);
+  }
+  return safe;
+}
+
+function initTelemetry() {
+  if (telemetryDisabled()) return false;
+
+  Sentry.init({
+    dsn: DSN,
+    environment: process.env.NODE_ENV || 'production',
+
+    // Errors only. Traces from a CLI describe the customer's build pipeline,
+    // which is more than is needed to fix a crash.
+    tracesSampleRate: 0,
+
+    // No usernames, IPs, or machine hostnames.
+    sendDefaultPii: false,
+    serverName: false,
+
+    beforeSend(event) {
+      if (event.message) event.message = scrub(event.message);
+
+      for (const entry of event.exception?.values ?? []) {
+        if (entry.value) entry.value = scrub(entry.value);
+        // Stack frames carry absolute paths from the customer's disk. The
+        // filename is what makes a trace useful, so keep the basename only.
+        for (const frame of entry.stacktrace?.frames ?? []) {
+          if (frame.filename) frame.filename = frame.filename.replace(/^.*[\\/]/, '');
+          delete frame.abs_path;
+        }
+      }
+
+      // Belt and braces: whatever else ends up in extra, scrub its strings.
+      if (event.extra) {
+        for (const [k, v] of Object.entries(event.extra)) event.extra[k] = scrub(v);
+      }
+
+      return event;
+    },
+  });
+
+  return true;
+}
+
+/** Report an error with only the context that is safe to leave the machine. */
+function captureCliError(error, argv) {
+  if (telemetryDisabled()) return;
+
+  Sentry.withScope((scope) => {
+    const safe = sanitizeArgv(argv);
+    if (safe.project) scope.setTag('project', safe.project);
+    if (argv && argv._) scope.setTag('command', argv._[0] || 'deploy');
+    scope.setExtra('options', safe);
+    Sentry.captureException(error);
+  });
+}
+
+async function flushTelemetry(ms = 2000) {
+  if (telemetryDisabled()) return;
+  await Sentry.close(ms);
+}
+
+module.exports = {
+  initTelemetry,
+  captureCliError,
+  flushTelemetry,
+  telemetryDisabled,
+  sanitizeArgv,
+  scrub,
+  SAFE_ARGV_FIELDS,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrymore/scry-deployer",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "A CLI to automate the deployment of Storybook static builds.",
   "main": "index.js",
   "bin": {